CVE-2012-0911: TikiWiki CMS PHP Object Injection via Unserialize of Untrusted Input

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and public exploit code plus very high EPSS make this an urgent pre-auth remote code execution risk.

What it is

TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 passes attacker-controlled input (a cookie value and several print/send parameters) directly to PHP's unserialize function without proper handling. This is a PHP object injection flaw (CWE-502) that lets a remote attacker supply a crafted serialized object to influence application logic. Because the affected code paths are reachable without authentication, it is a serious pre-auth risk for any exposed TikiWiki instance.

Impact

An attacker can execute arbitrary PHP code on the server, giving full control of the web application and its data. Depending on the hosting context, this can extend to the underlying operating system.

Attack surface

Reachable over the network via HTTP requests to tiki-print_multi_pages.php, tiki-print_pages.php, tiki-send_objects.php, and via the cookieName value handled in lib/banners/bannerlib.php. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.

Exploitation

Public exploit code exists (Exploit-DB entries 19573 and 19630, plus a Bugtraq post tagged Exploit), and EPSS is 0.62989 (99.2nd percentile), indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, so there is no confirmed in-the-wild record from that source.

What to do

• Upgrade TikiWiki to 6.7 LTS or 8.4 or later; these are the fixed releases named in the advisory.
• If immediate upgrade is not possible, restrict network access to the affected scripts (tiki-print_multi_pages.php, tiki-print_pages.php, tiki-send_objects.php) and to the banner library paths.
• Remove or replace unsafe unserialize() calls on user-controlled data with safe parsing (for example json_decode) or strict allowed-class handling.
• Deploy a WAF rule to block serialized-object payloads (O: and C: patterns) in cookies and in the printpages, printstructures, sendpages, sendstructures, and sendarticles parameters.
• Audit the web server account for unnecessary write or execution privileges to limit post-exploitation impact.

Detection

• Search web logs for requests to tiki-print_multi_pages.php, tiki-print_pages.php, and tiki-send_objects.php containing serialized object markers such as O: or C: in query parameters or cookies.
• Alert on cookie values containing serialized PHP object syntax, particularly for the banner cookieName handling.
• Monitor for unexpected PHP file creation or modification under the TikiWiki web root, which may indicate webshell deployment after code execution.
• Review PHP error logs for unserialize warnings or class-related errors tied to these endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.